Notice of Privacy Practices of Therapy Aligned LLC

Combined notice under HIPAA (45 CFR Parts 160 and 164) and 42 CFR Part 2.

Notice to Patients · HIPAA & 42 CFR Part 2 · Effective: 2026-10-06 · Version 2.8

THIS NOTICE DESCRIBES:

• HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
• YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION
• HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION

PLEASE REVIEW IT CAREFULLY.

YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH THE PRIVACY OFFICER, ANDREW H. KIM, AT (732) 301-6802 OR CONNECT@THERAPY-ALIGNED.COM IF YOU HAVE ANY QUESTIONS.

This Notice applies to all health information created or maintained by Therapy Aligned LLC ("Therapy Aligned," "we," "us," or "our"). Because we provide substance use disorder (SUD) treatment, we are a Part 2 program and this Notice also serves as our notice under 42 CFR § 2.22.

Special Protection for Substance Use Disorder (SUD) Records — 42 CFR Part 2

Records that would identify you as someone who has applied for or received substance use disorder diagnosis, treatment, or referral for treatment are protected by special federal rules at 42 CFR Part 2, which in many cases are more protective than HIPAA. Where Part 2, New Jersey law, or HIPAA differ, we follow the most protective rule.

• We will not disclose your SUD records without your specific written consent, except in the limited circumstances described under Limited Exceptions below.
• A general HIPAA authorization does not satisfy Part 2. We obtain a separate written consent meeting 42 CFR § 2.31 before disclosing your SUD records.
• A single written consent may authorize all of your future uses and disclosures for treatment, payment, and health care operations (TPO), and may name recipients by a general designation. You do not have to sign a new consent for each disclosure that consent covers. You may revoke that consent in writing at any time. Our own consent is narrower: it does not cover routine sharing with a provider outside our practice, which takes a separate signed release naming that provider.
• Your SUD records, and testimony relaying their content, may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding against you unless based on your specific written consent or a court order issued under 42 CFR §§ 2.64–2.65. A court order authorizing use or disclosure must also be accompanied by a subpoena or other similar legal mandate before we release anything. A subpoena, warrant, or discovery request alone is never enough. For a court order, you or the record holder must receive notice and an opportunity to be heard where required by law, and the order must be limited in scope.
• Redisclosure warning. Once a HIPAA covered entity or business associate receives your SUD records based on your consent for treatment, payment, or health care operations, that recipient may further use or disclose those records as the HIPAA Privacy Rule permits, and those records may then no longer be protected by Part 2.
• If you authorize sharing through an intermediary (a separate organization that passes your records to its participating treating providers), you may ask it in writing for a list of its disclosures in the past three years. If you ask our Privacy Officer in writing, we will also list the outside organizations we disclosed your information to under your TPO consent.

Limited Exceptions — When Part 2 Allows Disclosure Without Your Consent

Part 2 is narrow. We may use or disclose your SUD records without your written consent only for:

• A bona fide medical emergency (42 CFR § 2.51), to medical personnel who need the information to treat a condition posing an immediate threat to health. We document every such disclosure.
• Communications within our own practice, and to a Qualified Service Organization that helps us operate under a written agreement binding it to Part 2.
• Scientific research, audits, and program evaluation, under Part 2's specific conditions.
• A court order meeting 42 CFR §§ 2.61–2.67, accompanied by a subpoena or similar legal mandate.
• Reporting a crime on our premises or against our staff, and reporting suspected child abuse or neglect as New Jersey law requires — though your SUD records may not then be used in any resulting proceeding against you without your consent or a qualifying court order.
• Information about a deceased patient, as Part 2 permits.
• A minor's parent or guardian, in one narrow case. Without the minor's consent, our program director may tell a parent or guardian facts needed to reduce a substantial threat to the life or physical well-being of the minor or another person, but only after deciding the minor cannot make a rational decision about sharing them, because of extreme youth or a mental or physical condition (42 CFR § 2.14(c)).

Part 2 contains no general "duty to warn" exception and no exception for reporting abuse of an adult. Where we have a legal duty to act to protect someone, we limit what we disclose so that it does not identify you as a substance use disorder patient, unless you consent or a qualifying court order permits more.

How We Use and Share Your Health Information for Treatment, Payment, and Health Care Operations

HIPAA generally allows a practice to use and share health information for treatment, payment, and health care operations without your written authorization. Therapy Aligned follows the narrower limits below, and the additional protections for SUD records described above.

• Treatment. We use your information to provide and manage your care — for example, to develop your treatment plan. Routine sharing with a provider outside our practice — for example, coordinating with your psychiatrist or with a provider we refer you to — takes your signed release naming that provider.
• Payment. We use your information to bill and collect payment — for example, to send you a statement or process your card payment. We check insurance benefits and send claims only if you ask us to use your insurance. We do not send your insurance company information about care you pay for yourself, unless the law requires it.
• Health Care Operations. We use your information for clinical supervision, quality review, training, and running the practice — for example, consultation among our own clinicians. The outside services described under Service Providers receive only what their work for us needs.

The legal, safety, and emergency exceptions described in this Notice still apply. They do not allow routine coordination with an outside provider, or routine disclosures to an insurer about care you pay for yourself.

Important: HIPAA's permissions do not by themselves allow us to disclose your SUD records. Sharing those records takes your written Part 2 consent unless a specific exception in this Notice applies. That is why we ask you to sign the Consent for Treatment, Payment & Health Care Operations: it covers the outside services that help us run the practice and, only if you ask us to use your insurance, your health plan. It does not replace the separate signed release we require for routine sharing with a provider outside our practice.

We limit every use and disclosure to the information necessary to accomplish its purpose. For your SUD records, that limit applies to every use and disclosure, including for treatment (42 CFR § 2.13).

Service Providers

We use outside service providers to help operate the practice — our electronic health record and billing system, our payment processor, our email and document platform, and the secure cloud service that runs our AI-assisted documentation tools — each under a written agreement that requires it to protect your information. The providers currently in these roles are listed in our Practice Policies; you may ask the Privacy Officer for the current list at any time, and we will give you at least 30 days' written notice before replacing one. We limit what each provider receives to what its service needs, and card-payment records never carry a diagnosis or treatment detail. Our clinicians may use AI-assisted tools for documentation and certain therapeutic exercises. Those tools run on a secure cloud service under a HIPAA Business Associate Agreement; the service retains none of your information and does not use it to train AI models. Any other AI tool we use either meets the same standard or runs entirely on practice-controlled devices. Your clinician reviews anything an AI tool produces before it enters your record, and you may decline AI use in your care at any time (see the Informed Consent).

Uses and Disclosures That Require Your Written Consent or Authorization

• Any disclosure of SUD records protected by 42 CFR Part 2 (a § 2.31 consent).
• Psychotherapy notes and separately maintained SUD counseling notes. These are notes your therapist keeps apart from the rest of your record to document a private session; they are not your progress notes, diagnosis, medications, or treatment plan. A consent for SUD counseling notes must stand alone and cannot be combined with any other release. We will never condition your treatment, payment, enrollment, or eligibility for benefits on your signing one.
• Marketing, and any sale of your information.
• Any other use or disclosure not described in this Notice. Except as described here, we will not use or disclose your health information without your written consent or authorization, which you may revoke at any time.

Other Uses and Disclosures Permitted or Required by Law

For records that are not Part 2-protected, we may use or disclose information without your authorization when required by law; for certain public-health activities and health-oversight audits; to report suspected abuse, neglect, or domestic violence; to prevent a serious and imminent threat to health or safety; in response to a valid court order; to coroners and medical examiners; for workers' compensation; and for certain government functions. Each of these is narrower, or unavailable, for your SUD records — see Limited Exceptions above.

Fundraising

We do not use or disclose your information for fundraising.

Your Rights

You have the right to:

• Inspect and copy your health information (a reasonable, cost-based fee may apply for copies).
• Request an amendment of information you believe is incorrect or incomplete.
• Request an accounting of disclosures. For disclosures subject to HIPAA's accounting right, you may request a list covering the six years before your request. For disclosures of your Part 2 records, you may request a list covering the three years before your request.
• Request a list of disclosures made by an intermediary. If an intermediary shares your records with its participating treating providers, you may ask it in writing for a list of its disclosures within the past three years.
• Request restrictions on how we use or disclose your information.
• Self-pay privacy. We do not send your insurance company information about care you pay for yourself, unless the law requires it. You also have the legal right to ask us not to tell your health plan about a service you paid for in full, and we will honor that request except as required by law.
• Request confidential communications by alternative means or at an alternative location.
• Revoke your consent or authorization in writing at any time, except to the extent we have already acted in reliance on it.
• Obtain a paper or electronic copy of this Notice at any time, at no charge, and to discuss any of it with us.

Our Duties

• We are required by law to maintain the privacy and security of your protected health information, including your SUD records, to give you this Notice of our legal duties and privacy practices, and to abide by the terms of the Notice currently in effect.
• Breach notification. We will notify you following a breach of unsecured protected health information as required by the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D), which applies to records protected under 42 CFR Part 2.
• We reserve the right to change our privacy practices and the terms of this Notice and to make the revised terms effective for all records we maintain. If we make a material change, we will post the revised Notice on our website and make it available on request.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer (below) or with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, DC 20201; 1-877-696-6775; www.hhs.gov/ocr/privacy/hipaa/complaints. You will not be penalized or retaliated against for filing a complaint.

Contact — Privacy Officer

Contact the Privacy Officer to ask questions about this Notice, request a free copy, discuss anything in it, or exercise any of your rights.

Effective Date: October 6, 2026. This Notice supersedes any prior Notice of Privacy Practices.